Description
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 5.0.0.
Published: 2026-11-09
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: Stored Cross‑Site Scripting (XSS)
Action: Update Plugin
AI Analysis

Impact

The vulnerability in the WordPress All‑in‑One Video Gallery plugin occurs when unsanitized input is stored and later rendered in web pages, enabling arbitrary JavaScript execution in browsers that view those pages. The weakness is identified as CWE‑79.

Affected Systems

The plugin version range affected is any release from the earliest version up to and including 5.0.0 of the All‑in‑One Video Gallery from Plugins360 Labs.

Risk and Exploitability

The CVSS score is 6.5, indicating moderate severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalogue. The likely attack vector involves an attacker submitting malicious input via the plugin’s stored fields, which are then executed when the content is displayed to site visitors.

Generated by OpenCVE AI on November 9, 2026 at 12:52 UTC.

Remediation

Vendor Solution

Update the WordPress All-in-One Video Gallery plugin to the latest available version (at least 5.1.0).

OpenCVE Recommended Actions

  • Update the All‑in‑One Video Gallery plugin to version 5.1.0 or newer.
  • Remove any existing unsanitized video titles, descriptions, or metadata that were stored in the plugin before the upgrade to eliminate legacy XSS payloads.
  • Disable or restrict access to the plugin’s input forms to prevent new malicious data from being stored until the plugin is upgraded.

Generated by OpenCVE AI on November 9, 2026 at 12:52 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 09 Nov 2026 11:15:00 +0000

Type Values Removed Values Added
Description Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs All-in-One Video Gallery all-in-one-video-gallery allows Stored XSS.This issue affects All-in-One Video Gallery: from n/a through 5.0.0.
Title WordPress All-in-One Video Gallery plugin <= 5.0.0 - Cross Site Scripting (XSS) vulnerability
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-11-09T11:00:07.969Z

Reserved: 2026-11-03T00:24:21.836Z

Link: CVE-2026-120838

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-11-09T11:17:22.123

Modified: 2026-11-09T11:17:22.233

Link: CVE-2026-120838

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-09T13:00:15Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')